adding a rule for defensive evasion iso mounted from zip temp directory

[adminsb42]

Pull Request

Issue link(s):

Summary - What I changed

How To Test

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly (no credentials or tokens; exclusions use generic non-identifying vendor/install paths — not usernames, hostnames, org names, cluster/agent IDs, IP addresses, or internal workspace/repo trees; cloud/SaaS rules only hard-code vendor first-party or marketplace-listed app/client IDs — never tenant, subscription, account, or project IDs; sample JSON is redacted)
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[cla-checker-service]

❌ Author of the following commits did not sign a Contributor Agreement:
57e321a

Please, read and sign the above mentioned agreement if you want to contribute to this project

[adminsb42]

Wrong repo